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AMENDMENTS TO THE CLAIMS: 



This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

Listing of Claims: 

Claim 1 (Currently Amended): An anti-malware anti virus file scanning system 
for computer files being transferred between computers, the system comprising: 

a) a computer database containing records of known executable programs 
which are deemed to be not malware and criteria by which a file being processed can be 
determined to be an instance of one of those programs , the criteria including at least one 
characteristic signature associated with each said instance ; 

b) means for processing a file being transferred between computers , the means 
b) comprising: 

a file recogniser operative to determine whether the file being processed is an 
instance of a known program by checking the contents of the file being processed for the 
presence of said at least one characteristic signature associated with the said instances; 
and 

a difference checker operative, in the case that the file recogniser determines the 
file being processed to be an instance of a known program, to check whether the file is an 
unchanged version of that known program to d e t e rmin e wh e th e r th e file match e s th e 
crit e ria characterising a file as an unchang e d instanc e of a program in th e database ; and 

c) means for signalling the file,, as known or not depending on the 
determination made by the processing means , as being: 

likely to be not malware if it is an unchanged version of a known file; 

likely to be malware if it is a changed version of a known file; or 

of unknown status if it is not determined as being an instance of a known file . 
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Claim 2 (Currently Amended): A system according to claim 1 and including: 
d) means for processing a an inputt e d file being transferred between 
computers to determine whether it is considered to be, or considered possibly to be, 
malware inf e ct e d with a viru s, and wherein the means d) is operative to subiectr 4n 
op e ration of the system, a file is subject e d to processing if the file is signalled by th e 
m e ans d) unless th e fil e is signall e d as safe by the signalling means c) as being of 
unknown status . 

Claims 3 and 4 (Canceled). 

Claim 5 (Currently Amended): A system according to claim 1 wherein the 
difference checker is operative to generate proc e ssing m e ans b) includ e s m e an s for 
g e n e rating a checksum for the entire file under consideration or for at least one selected 
region thereof, and to compare m e ans for comparing the checksum or checksums with 
those of entries in the database. 

Claim 6 (Currently Amended): A system according to claim 1 and including an 
exception list handler operative to determine for determining , in relation to a file which 
the processing means b) has determined is a changed version of set a known file, whether 
that file has characteristics matching an entry in an exception list of files, and the 
signalling means c) being is operative to signal the file as malware only if it is not in the 
exception list or as being of unknown status otherwise if it is . 

Claim 7 (Currently Amended): A method of anti-malware anti virus scanning 
syst e m computer files being transferred between computers, the method comprising: 

maintaining a computer database containing records of known executable 
programs which are deemed to be uninfected and criteria by which a file being processed 
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can be determined to be an instance of one of those programs , the criteria including at 
least one characteristic signature associated with each said instance ; 

processing a file being transferred between computers to d e t e rmin e wh e th e r th e 
fil e match e s th e crit e ria charact e rising a fil e as an unchang e d instanc e of a program in th e 
databas e by 

determining whether the file being processed is an instance of a known program 
by checking the contents of the file being processed for the presence of said at least one 
characteristic signature associated with the said instances, and 

checking, in the case that the file is determined to be an instance of a known 
program, whether the file is an unchanged version of that known program ; and 

signalling the file A a s known or not depending on the determination made by the 
processing means , as being: 

likely to be not malware if it is an unchanged version of a known file; 

likely to be malware if it is a changed version of a known file; or 

of unknown status if it is not determined as being an instance of a known file . 

Claim 8 (Currently Amended): A method according to claim 7 and including: 
processing a an inputt e d file being transferred between computers to determine 
whether it is considered to be, or considered possibly to be, malware, if the file is 
signalled by inf e ct e d with a virus, and wh e r e in, in op e ration of the syst e m, a fil e i s 
subj e ct e d to proc e ssing by th e st e p d) unl e ss th e fil e is signall e d as saf e by the signalling 
step c) as being of unknown status . 

Claims 9 and 10 (Canceled). 

Claim 1 1 (Currently Amended): A method according to claim 7 wherein the step 
of checking whether the file being processed is an instance of a known program 
comprises th e processing st e p b) includ e s generating a checksum for the entire file under 
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consideration or for at least one selected region thereof, and comparing the checksum or 
checksums with those of entries in the database. 

Claim 12 (Currently Amended): A method according to claim 7 further and 
including using an exception list to determine, in relation to a file which the processing 
step b) has determined is a changed version of aet a known file, whether that file has 
characteristics matching an entry in an exception list of files, and wherein, in the 
signalling step c) steps, the file is signalled as malware if it is not in the exception list or 
as being of unknown status otherwise if it i s. 

Claim 13 (New): An anti-malware file scanning system for computer files 
being transferred between computers, the system comprising: 

a computer database containing records of known executable programs which are 
deemed to be not malware and criteria by which a file being processed can be determined 
to be an instance of one of those programs, the criteria including at least one 
characteristic signature associated with each said instance; 

a processor for processing a file being transferred between computers, the 
processor being operative to determine whether the file being processed is an instance of 
a known program by checking the contents of the file being processed for the presence of 
said at least one characteristic signature associated with the said instances and, in the case 
that the file being processed is determined to be an instance of a known program, to 
check whether the file is an unchanged version of that known program, 

said processor, depending on the determination, identifying the file being 
processed as (i) likely to be not malware if it is an unchanged version of a known file; (ii) 
likely to be malware if it is a changed version of a known file; or (iii) of unknown status 
if it is not determined as being an instance of a known file. 
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Claim 14 (New): An anti-malware file scanning system according to claim 13, 
further comprising: 

a file-scanning subsystem for scanning files identified by the processor as being of 
unknown status to determine whether the scanned files are malware. 

Claim 15 (New): An anti-malware file scanning system according to claim 14, 
wherein records for files which are instances of programs determined by the file-scanning 
system not to be malware are added to the computer database. 

Claim 16 (New): An anti-malware file scanning system according to claim 13, 
wherein the processor assigns a score to a file identified as likely to be malware. 



